Risk management, strategy and analysis from DeloitteCONTENT FROM OUR SPONSORPlease note: The Wall Street Journal News Department was not involved in the creation of the content below.

Text Size

Regular

Medium

Large

Google+

Print

Why Reputational Risk Is a Strategic Risk

In today’s risk-filled business environment, it can be hard for executives to have confidence that their plans and strategies will play out as expected. A big reason is that strategic risks—those that either affect or are created by business strategy decisions—can strike more quickly than ever before, hastened by rapid-fire business trends and technological innovations such as social media, mobile and big data. And reputational risks can damage the most well-crafted business strategies.

Here, Henry Ristuccia, partner, Deloitte & Touche LLP, and global leader, Governance, Risk and Compliance Services, Deloitte Touche Tohmatsu Limited, discusses why aligning strategic risk and reputational risk has become a high priority for many executives and what steps should be taken to make that happen.

Q: How does reputational risk differ from other types of risk, and does it require a different management approach?

Henry Ristuccia: Social media has had such a big impact in recent years that all organizations want to know what their customers and competitors are saying about them. In fact, in a recent joint study by Deloitte and Forbes Insights that surveyed 300 executives, mostly C-suite and board directors, reputation is considered the highest impact risk area to business strategy. This finding cuts across most industry sectors and ranks above threats to their business model and the impact of economic trends and competition.

So protecting reputation is clearly a top issue for companies, the C-suite and boards of directors. Having said that, traditional risk management is challenged to address reputational risk in two fundamental ways. First, traditional risk management has historically been focused inward, on the workings of the organization, where the main risks involve producing a product in a reasonable fashion, such as using the right materials and producing the product with sufficient quality—all things that tend to happen either within an organization or within an organization’s control.

Reputation, however, is shaped outside the organization. Being able to measure and monitor that risk is critical, which is another reason traditional approaches often won’t work because the tools and analyses are so different. When organizations have a reputational risk problem, it usually involves the media and what its customers, employees and other stakeholders are saying in the public domain. So this kind of risk is at an event level these days, not the company level. And traditional risk management doesn’t focus on that nor does it offer the tools to address it.

Q: Social media tends to dominate discussions of reputational risk, but are there other trends worth watching that could impact companies’ reputations?

Henry Ristuccia: First, many companies are starting to regard reputational risk as a strategic risk and that is an important development. Second, companies are focusing more on the role that innovation plays in their strategy and, equally important, what could disrupt not only the strategy but the business. Now, innovation and disruption are different sides of the same coin, the good and the evil if you will. If you innovate, you may be able to affect markets; if you don’t innovate, you’ll be disrupted by your competitors. And disruption typically presents the greatest risk to strategy that an organization could face.

One dimension of risk to corporate strategy and the ability of companies across all industries to innovate is the digital phenomenon, including social media, mobile, big data and technology. Companies that are at the leading edge of managing reputational risk are finding ways to link strategy and innovation with their risk management programs and to identify where the next disruption could come from. They’re using data analytics to gather and help interpret market intelligence to identify threats to their reputation. They also are using data analytics to spot risks to their business models and identify opportunities to develop new business models.

Q: How do these organizations incorporate risk management and oversight deeply into their strategy setting?

Henry Ristuccia: For many—especially for more senior stakeholders—it starts with what is commonly called risk appetite. To get to that point, however, an organization should start with their strategy and ask, “what are the things that could go wrong with that strategy?” That could involve a stress test where they validate their business strategies and look at alternative models and scenario analysis. Looking at those scenarios starts to give you your risk appetite and how you should be thinking about risk and strategy together. That’s one way to think about the intersection of strategy and risk.

The challenge is that many organizations still take a rear-view mirror approach to risk, especially reputational risk. For example, in the case of an adverse event to their reputation, they may get legal, corporate communications and PR involved, and then they may do a post mortem to help avoid a similar event. That essentially is crisis management, not reputational risk management. While crisis management is important, it may not be enough when dealing with reputational risk issues as it typically entails taking backward-looking, reactive measures after an event has occurred.

In contrast, managing reputational risk should start with looking at the strategy, what markets a company is entering, what products or services it is offering and what are the critical risks and value killers that could sink the company’s brand. The next step is developing an early warning system to see and head off an adverse event before it can impact reputation. That forward-looking approach is fundamental to anticipating and managing the new risks that the digital phenomenon is presenting.

Q: How can organizations construct an effective early warning system for identifying reputational risks?

Henry Ristuccia: Fundamental to an early warning system is taking an ‘outside-in’ perspective and separating the information from the data, or the signal from the noise. To do that, you should understand the business strategy and the risks to the strategy, that is, the value killers. With that foundation, a company can begin to identify and create listening posts, which can help it understand and monitor how it’s perceived by employees, customers, vendors, shareholders, analysts, activists, non-governmental organizations (NGOs), competitors and others.

For example, if a company is in a very labor-intensive industry, with many hourly rate and part-time workers, where there may be an issue in the marketplace, a company could create listening posts to understand what different groups are saying about the company, its workplace practices, its safety record and other aspects. It can be helpful to listen to what is being said about your company, as well as about your competitors, especially if the issues are industry-wide.

It can also help to understand from which group criticisms of a company or an industry are emanating, as they may not necessarily be coming from customers or consumers, but rather other vocal constituents such as NGOs. Understanding outside perceptions and what is shaping those perceptions can help an organization make strategic decisions with regard to products, services, pricing, locations, advertising, sponsorships and other corporate activities.

Q: Many discussions on reputational risk issues concern consumer-facing companies. How important are such risks to business-to-business (B2B) organizations?

Henry Ristuccia: B2B companies should be just as diligent as consumer companies when it comes to managing reputational risk, regardless of whether they are selling products or services. For example, supply chain risks can impact a company’s reputation, whether or not they sell directly to consumers and no matter how far up the chain they may be. B2B companies should understand who’s downstream from them and what other organizations at each level of the supply chain are doing to produce a quality product and manage risk.

That has become even more critical in light of the Conflict Minerals Rule, mandated by Section 1502 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, which requires companies to identify minerals used in their supply chain from certain conflict regions that may be using the proceeds to finance armed groups. If a company doesn’t closely monitor its compliance with the rule and its affiliations with suppliers all the way down the supply chain, that could have a significant impact on its reputation and how an organization is perceived by stakeholders. So consumers are an important constituency in reputational risk issues, but they’re not the only ones.

About Deloitte Insights

Deloitte’s Insights for C-suite executives and board members provide information and resources to help address the challenges of managing risk for both value creation and protection, as well as increasing compliance requirements.

This copy is for your personal, non-commercial use only. Distribution and use of this material are governed by our Subscriber Agreement and by copyright law. For non-personal use or to order multiple copies, please contact Dow Jones Reprints at 1-800-843-0008 or visit www.djreprints.com.